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CLAIMS 

1. Procedure for the analysis of the access to a data 
communication network by a user (LAN) , characterised by the 
fact that it comprises the operations of tracing (Al) the 
traffic of said user (LAN) , and identifying a group of 
networks with which said traffic is mainly handled, by 
defining (100) relative autonomous systems (AS) and tracing 
the sequence of autonomous systems crossed by said traffic; 
the tracing operation of said sequence including: 

- a first stage (Bl) , to provide the list (102) of the 
paths of autonomous systems crossed by said traffic to 
reach each destination, and 

- a second stage (B2) , to aggregately elaborate said 
list of paths, outputting a tree representing all the paths 
of the autonomous systems crossed by the traffic of said 
user (IiAN) to reach all corresponding destinations. 

2. Procedure as per claim 1, characterised by the fact 
that it comprises the operation of determining the routing 
of said traffic on the branches of said tree, and the 
operation of associating the respective indicative values 
of the traffic that crosses the branch to the branches of 
said tree. 

3. Procedure as per claim 1 or claim 2, characterised 
by the fact that it comprises the operation of using 
hardware probes tq_ trace the traffic of said user. 

4 . Procedure as per claim 3 , characterised by the fact 
that it comprises the operation of configuring said 
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hardware probes to provide information selected in the 
group consisting of: band use of the individual link, data 
volume, protocol -subdivision, IP address -subdivision, 
traffic matrix between the user (LAN) and the network 

5. Procedure as per claim 3 or claim 4, characterised 
by the fact that it comprises the operation of configuring 
said hardware probes to determine at least one selected 
item in the group consisting of: sites most frequently 
visited by the user, main networks to which the user 
addresses its traffic, and the origin of who connects up to 
said user. 

6. Procedure as per claim 1 or claim 2, characterised 
by the fact that it comprises the operation of setting 
software agents on the data communication network access 
routers to trace said user traffic. 

7. Procedure as per claim 6, characterised by the fact 
that it comprises the operation of configuring said 
software agents to trace the traffic through the interface 
of the router of said user to determine the main traffic 
lines. 

8. Procedure as per claim 6, characterised by the fact 
that it comprises the operation of configuring said 
software agents to analyse the operating status of the 
respective router in terms of CPU load and available 
memory . 

9. Procedure as per claim 6, characterised by the fact 
that it comprises the operation of providing a target 
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machine for the transfer of the statistics obtained by said 
routers . 

10. Procedure as per claim 1, characterised by the fact 
that it comprises the operation of generating, as the 
result of said traffic tracing operation of said user, at 
least one parameter selected from the group consisting of: 
destination networks of said traffic, percentage of traffic 
involved, pertinent autonomous system. 

11. Procedure as per claim 1, characterised by the fact 
that said first stage (Bl) comprises the operations of 
inputting a file containing the IP addresses representing 
the sites most frequently visited by said user and 
performing a traceroute function for each destination site, 
by tracing the path to reach this destination. 

12. Procedure as per claim 11, characterised by the 
fact that it comprises the operation of tracing said path 
as a sequence of autonomous systems (AS) crossed. 

13. Procedure as per claim 11, characterised by the 
fact that in said first stage said tracing operations are 
carried out repeatedly with a given frequency. 

14. Procedure as per claim 13, characterised by the 
fact that said frequency can be determined and selected. 

15. Procedure as per claim 1, characterised by the fact 
that said second stage (B2) comprises the operation of 
generating a unique tree of paths of the autonomous systems 
crossed by the traffic of said user to reach all the 
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destinations, the leaves of said tree being indicative of 
the destination subnetworks of the traffic of said user. 

16. Procedure as per claim 1, characterised by the fact 
that said second stage (B2) comprises the operation of 
providing, in relation to the list of said autonomous 
systems crossed by said traffic of said user, at least one 
parameter from: the percentage of use of the autonomous 
system, a time value for passing through said autonomous 
systems and a hops value inside the autonomous system. 

17* Procedure as per claim 16 , characterised by the 
fact that at least one and preferable all said data 
provided are expressed as an average value, 

18* Procedure as per claim 1 or claim 11, characterised 
by the fact that said first stage (Bl) comprises the 
operation of invoking for each IP address generated via 
said traceroute function, a remote service to obtain at 
least one item of the information included in the group 
consisting of: name of the autonomous system to which the 
generated IP address belongs and the number of the 
autonomous system to which said generated IP address 
belongs . 

19. Procedure as per claim 18, characterised by the 
fact that said remote service is the whois service of the 
databases RIBE, ARIN, APNTC. 

20. Procedure as per claim 1, characterised by the fact 
that said first stage (Bl) comprises the operation of 
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generating a data file (103) comprising information 

* 

selected from the group consisting of: 

- order number of the autonomous system following the 
sequence of IP addresses provided by said traceroute 
function, 

- text name of the autonomous system, 

- identification number of the autonomous system, 

- number of hops that a single tracing command has 
measured inside the autonomous system, and 

- time of permanence in the autonomous system measured 
by a single tracing command. 

21. Procedure as per claim 1 or claim 11 , characterised 
by the fact that it comprises the operation of performing a 
plurality of said tracing functions in parallel during said 
first stage . 

22 . Procedure as per claim 1, characterised by the fact 
that said second stage (B2) comprises the operation of 
storing information of correspondence between IP addresses 
and the data relating to the pertinent autonomous systems . 

23. Procedure as per claim 1, characterised by the fact 
that said second stage (B2) comprises the operation of 
generating the leaves of said tree as identification of the 
destination subnetworks of the traffic of said user and the 
relative branches as identifications of the autonomous 
systems crossed by the traffic. 

24. Procedure as per claim 1, characterised by the fact 
that said second stage (B2) is performed in association 
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with a central memory with a data structure that represents 
the paths generated in said first stage in the form of at 
least one aggregated list. 

25. Procedure as per claim 24, characterised by the 
fact that the said at least one aggregated list is 
identified as representing a variable number of autonomous 
isystem lists that share a common maximum prefix. 

26. System for the analysis of the access to a data 
communication network by a user (LAN) , characterised by the 
fact that the system is configured to trace (Al) the 
traffic of said user (IAN) and identify a group of networks 
with which this traffic is mainly involved, by identifying 

(100) relative autonomous systems (AS) and tracing the 
sequence of autonomous systems crossed by said traffic; to 
trace said system the system including a first module (Bl) 
that provides the list (102) of paths of autonomous systems 
crossed by said traffic to reach each destination, and a 
second module (B2) to aggregately elaborate said list of 
paths by output ting a tree representing all the paths of 
the autonomous systems crossed by the traffic of said user 

(LAN) to reach all relative destinations. 

27. System as per claim 26, characterised by the fact 
that the system is configured to measure the routing of 
said traffic on the branches of said tree and associate 
respective indicative values of the traffic crossing the 
branch to the branches of said tree. 
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28. System as per claim 26 or claim 27, characterised 
by the fact that it comprises hardware probes to trace the 
traffic of said user. 

29. System as per claim 28, characterised by the fact 
that said hardware probes are configured to supply 
information selected in the group consisting of: use of 
single link band, data volume, protocol -subdivision, IP 
address-subdivision, traffic matrix between the user (LAN) 
and the network. 

3D. System as per claim 28 or claim 29, characterised 
by the fact that said hardware probes are configured to 
determine at least one item selected in the group 
consisting of: sites most frequently visited by the user, 
main networks addressed by the user traffic, origin of 
those who connect up to said user. 

31. System as per claim 2 6 or claim 27, characterised 
by the fact that it comprises software agents on the data 
communication network access router to trace the said 
traffic of the user. 

32. System as per claim 31, characterised by the fact 
that said software agents are configured to trace the 
traffic through the interface of the router of said user by 
determining the main traffic lines. 

33. System as per claim 31, characterised by the fact 
that said software agents are configured to perform an 
analysis on the operating status of the respective router 
in terms of CPU load and available memory. 
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34 . System as per claim 31, characterised by the fact 
that it comprises a target machine for the transfer of the 
statistics obtained by said routers* 

35- System as per claim 26, characterised by the fact 
that it is configured to generate as the result of said 
tracing operation of the traffic of said user at least one 
of the parameters selected from the group consisting of: 
destination networks of said traffic, percentage of traffic 
involved, pertinent autonomous system. 

36* System as per claim 26, characterised by the fact 
that said module (Al) is configured to input a file 
containing the IP addresses representing the sites most 
frequently visited by said user and to perform a tracing 
operation (traceroute) to this destination for each 
destination site, by tracing the path to reach this 
destination, 

37. System as per claim 36, characterised by the fact 
that said first module is configured to trace said path as 
a sequence of autonomous systems (AS) that are crossed. 

38. System as per claim 36, characterised by the fact 
that said first module is configured to repeatedly perform 
said tracing operations with a given frequency. 

39. System as per claim 38 , characterised by the fact 
that said first module is configured so that said frequency 
can be determined and selected. 

40. System as per claim 26, characterised by the fact 
that said second module (B2) is configured to output a 
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unique tree of autonomous systems paths crossed by the 
traffic of said user to reach all the destinations, the 
leaves of said tree being indicative of the destination 
subnetworks of the traffic of said user, 

41. System as per claim 26, characterised by the fact 
that said second module (B2) is configured to provide, in 
relation to the list of said autonomous systems crossed by 
said traffic of said user, at least one parameter from: the 
percentage of use of the autonomous system, a value of time 
of permanence inside said autonomous systems and a value of 
hops inside said autonomous system. 

42. System as per claim 41, characterised by the fact 
that at least one and preferably all said data provided are 
expressed as an average value. 

43. System as per claim 26 or claim 36, characterised 
by the fact that said first module (Bl) is configured to 
invoke for each IP address generated via said tracing 
function (traceroute) , a remote service to obtain at least 
one of the following pieces of information included in the 
group consisting of: name of the autonomous system to which 
the generated IP address belongs and number of the 
autonomous system to which the aforesaid generated IP 
address belongs. 

44. System as per claim 43, characterised by the fact 
that said remote service is the whois service of the 
databases RIBE, ARIN, APNIC. 

• * 
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45. System as per claim 26, characterised by the fact 
that said first module (Bl) outputs a data file (103) 
including information selected in the group consisting of: 

- order number of the autonomous system following the 
sequence of the IP addresses provided by said tracing 
function, 

- text name of the autonomous system, 

- identification number of the autonomous system, 

- number of hops that a single tracing command has 
measured inside the autonomous system, and 

- time of permanence in the autonomous system measured 
by a single tracing command. 

46. System as per claim 26 or claim 36, characterised 
by the fact that said first module is configured to perform 
in parallel a plurality of said tracing functions. 

47. System as per claim 26, characterised by the fact 
that said second module (B2) contains a cache memory to 
store information of correspondence between IP addresses 
and data relating to the pertinent autonomous systems. 

48. System as per claim 26, characterised by the fact 
that said second module is configured so that the leaves of 
said tree are the destination subnetworks of the traffic of 
said user and the relative branches are the autonomous 
systems crossed by the traffic. 

49. System as per claim 26, characterised by the fact 
that said second module (Bl) is associated to one central 
memory with a data structure that represents the paths 
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generated by said first module in the form of at least one 
aggregated list. 

50. System as per claim 49, characterised by the fact 
that the said at least one aggregated list is identified as 
representing a variable number of autonomous system lists 
(VAS) that share a common maximum prefix. 

51. Computer program product directly loadable in a 
numerical processor internal memory and including parts of 
software code to implement the procedure as per any one of 
the claims 1 to 25 when the product is run on a processor. 
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